Systems and methods for managing policies on a computer

ABSTRACT

An apparatus, system, and method are disclosed for managing policies on a computer having a foreign operating system. Policies may specify hardware or software configuration information. Policies on a first computer with a native operating system are translated into configuration information usable on a second computer having a foreign operating system. In an embodiment, a translator manager manages the association between the policy on the first computer and the translator on the second computer. Computer management complexity and information technology management costs are reduced by centralizing computer management on the native operating system. Further reductions in management complexity are realized when the present invention is used in conjunction with network directory services.

RELATED APPLICATION

This application is a continuation of U.S. patent application Ser. No.10/888,845, filed Jul. 9, 2004, which is hereby incorporated herein byreference in its entirety.

BACKGROUND

1. Field of the Invention

This invention relates to managing groups of computers and moreparticularly relates to managing policies for configuring hardware orsoftware settings on groups of computers with a plurality of operatingsystems.

2. Description of the Related Art

A major concern of information technology management in corporations andother organizations has been balancing the complexity associated withmanaging large numbers of computers with the needs of individual usersas they try to accomplish their tasks. A heterogeneous set of computerhardware, operating systems, and application software creates complexityand increased costs, but various combinations of hardware, operatingsystems, and software provide technical advantages when used as userworkstations, departmental servers, corporate infrastructure equipment,and the like. User workstations are particularly difficult to managewhen various needs and preferences of individual users are accommodated.For example, an engineer may require the use of a CAD system that runsonly on the UNIX operating system, where other corporate users may bestandardized on the MICROSOFT WINDOWS operating system and associatedapplications. Many similar compatibility issues exist among currentcomputer systems.

One factor that adds to the complexity of managing various operatingsystems is that different operating systems employ different techniquesfor setting configuration information. For example, MICROSOFT WINDOWSand applications that run on Windows typically use a database, calledthe registry, to store configuration information. Computers running theUNIX operating system or derivatives thereof such as LINUX typicallystore configuration information in plain text files in particularlocations in the file system directory. Information technology managerswithin an organization that uses heterogeneous operating systemstypically institute separate sets of management procedures and standardsfor each operating system used in the organization.

One component of prior art solutions to the problem of managing largenumbers of computers and users is the use of policies. Policies are usedto set configurable options associated with an operating system orapplication program for a group of computer users. For example, a wordprocessing program may have an option to select an American Englishdictionary or a British English dictionary. By creating one policy forits users in the United States and another policy for its users inEngland, an organization can set the appropriate option for all userswithout configuring each user's computer individually.

Another component of prior art solutions to the problem of managinggroups of computers and users is the use of network directory services.Directory services provide an infrastructure to store and accessinformation about network-based entities, such as applications, files,printers, and people. Directory services provide a consistent way toname, describe, locate access, manage, and secure information aboutthese resources. The directories associated with directory services aretypically hierarchical structures such as a tree with each node in thehierarchy capable of storing information in a unit often referred to asa container. Enterprises may use directory servers and directoryservices to centrally manage data that is accessed from geographicallydispersed locations.

For example, corporations typically create network directory trees thatmirror their corporate organizations. Information about individualemployees, such as their employee number, telephone number, and hiredate may be stored in a user object corresponding to each user in thedirectory tree. An organizational unit container representing eachdepartment may contain the user objects associated with each employee inthe department. Organizational unit objects associated with eachcorporate division may contain the department organizational unitobjects associated with each department in the division. Finally, anorganization container representing the corporation as a whole maycontain the company's division organizational unit objects.

Combining the use of policies and directory services facilitatesmanagement of groups of computers and users. Policies may be associatedwith the various containers in the directory services tree to storeassociated configuration information at the organization, division, ordepartmental level. For example, a policy may be associated with theAccounts Receivable container in a corporate organization to set optionsfor the accounting program used in that department. Exceptions to thepolicy can be managed on an individual level, or by creating a groupobject and associating a policy with the group. Suppose, for example,that all employees in an organization use a software application with aparticular set of configuration options, but department managers requirea different set of options. A policy could be created with the basic setof options and associated with the organization container. A separatepolicy with the configuration options for managers could be created andassigned to a Managers user group object.

Using policies and directory services in combination has provenefficient in homogeneous operating system environments. Prior artcomputer management systems use policies targeted toward a specificoperating system, referred to as the native operating system. From thepoint of view of prior art policy and policy management systems, otheroperating systems are considered to be foreign operating systems.However, the operating requirements of many organizations requireinformation technology managers to manage multiple operating systems.The efficiencies associated with policies and directory services havenot been realized in heterogeneous operating system environments. Sincedifferent operating systems use different approaches to settingconfiguration information, a policy associated with a directory servicescontainer may be applied to users of a native operating system thatprovided the policies, but there may not be a method for applying thepolicy for users of a foreign operating system.

From the foregoing discussion, it should be apparent that a need existsfor an apparatus, system, and method that extend the use of policies tomanage configuration information on computers having operating systemsthat are foreign to the policy creation and management environment.Beneficially, such an apparatus, system, and method would control costand complexity associated with management of computers withheterogeneous operating systems within an organization. The benefits aremultiplied when network directory services are used in conjunction withpolicies.

SUMMARY

The present invention has been developed in response to the presentstate of the art, and in particular, in response to the problems andneeds in the art that have not yet been fully solved by currentlyavailable policy management systems. Accordingly, the present inventionprovides an apparatus, system, and method for managing policies on acomputer having a foreign operating system that overcome many or all ofthe above-discussed shortcomings in the art.

In one aspect of the present invention, a method for managing policieson a computer having a foreign operating system includes providing apolicy on a first computer with a native operating system, receiving thepolicy on a second computer with a foreign operating system, andtranslating the policy to configuration information usable on the secondcomputer. In one embodiment, the method includes receiving the policy onthe second computer at workstation start-up. The method also may includeupdating the policy at user login. These embodiments facilitateobtaining the current policy at the time they are typically needed byoperating systems.

In further embodiments, the method includes polling the first computerat periodic intervals for changes to the policy. In these embodiments,configuration information usable on the second computer is updated toreflect changes in policy on the first computer, to keep theconfiguration information and policy closely synchronized. The methodmay also con include applying configuration information associated withdirectory services containers and objects. For example, a policyassociated with a directory services organization container may betranslated to configuration information that may then be applied to allusers in the organization container.

In another aspect of the present invention, an apparatus to managepolicies on a computer having a foreign operating system includes apolicy on a first computer having a native operating system, a policytranslator that translates the policy to configuration informationusable on a second computer having foreign operating system, and atranslator manager that manages the association between the policy onthe first computer and the translator on the second computer. Theapparatus, in one embodiment, is configured to manage configurationinformation usable on a second computer having a foreign operatingsystem by means of policies on a first computer having a nativeoperating system. A translator manager manages the association betweenthe policy on the first computer, and a policy translator on the secondcomputer.

The apparatus is further configured, in one embodiment, to includepolicies associated with network directory services containers andobjects. Policies may be associated, for example, with organizationcontainers, organizational unit containers, and user objects,facilitating the configuration of hardware or software information forgroups of computer users at a corporate, department, or individuallevel.

Various elements of the present invention may be combined into a systemarranged to carry out the functions or steps presented above. In oneembodiment, the system includes two computers, the first having a nativeoperating system and the second having a foreign operating system. Inparticular, the system, in one embodiment, includes a directory servicesserver and database, a communications network, a policy, a policyeditor, a policy template, a translator manager, and a policytranslator.

Reference throughout this specification to features, advantages, orsimilar language does not imply that all of the features and advantagesthat may be realized with the present invention should be or are in anysingle embodiment of the invention. Rather, language referring to thefeatures and advantages is understood to mean that a specific feature,advantage, or characteristic described in connection with an embodimentis included in at least one embodiment of the present invention. Thus,discussion of the features and advantages, and similar language,throughout this specification may, but do not necessarily, refer to thesame embodiment.

Furthermore, the described features, advantages, and characteristics ofthe invention may be combined in any suitable manner in one or moreembodiments. One skilled in the relevant art will recognize that theinvention can be practiced without one or more of the specific featuresor advantages of a particular embodiment. In other instances, additionalfeatures and advantages may be recognized in certain embodiments thatmay not be present in all embodiments of the invention.

These features and advantages of the present invention will become morefully apparent from the following description and appended claims, ormay be learned by the practice of the invention as set forthhereinafter.

BRIEF DESCRIPTION OF THE DRAWINGS

In order that the advantages of the invention will be readilyunderstood, a more particular description of the invention brieflydescribed above will be rendered by reference to specific embodimentsthat are illustrated in the appended drawings. Understanding that thesedrawings depict only typical embodiments of the invention and are nottherefore to be considered to be limiting of its scope, the inventionwill be described and explained with additional specificity and detailthrough the use of the accompanying drawings, in which:

FIG. 1 is a schematic block diagram depicting one embodiment of atypical prior art networking environment wherein the present inventionmay be deployed;

FIG. 2 is a schematic block diagram illustrating one embodiment of aprior art policy management apparatus;

FIG. 3 is a schematic block diagram illustrating one embodiment of apolicy management system in accordance with the present invention;

FIG. 4 is a schematic block diagram illustrating another embodiment of apolicy management system in accordance with the present invention;

FIG. 5 is a schematic flow chart diagram illustrating one embodiment ofa provide translator method in accordance with the present invention;

FIG. 6 is a schematic flow chart diagram illustrating one embodiment ofa policy translation method in accordance with the present invention;and

FIG. 7 is a text diagram illustrating one embodiment of policytranslation example data in accordance with the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Many of the functional units described in this specification have beenlabeled as modules, in order to more particularly emphasize theirimplementation independence. For example, a module may be implemented asa hardware circuit comprising custom VLSI circuits or gate arrays,off-the-shelf semiconductors such as logic chips, transistors, or otherdiscrete components. A module may also be implemented in programmablehardware devices such as field programmable gate arrays, programmablearray logic, programmable logic devices or the like.

Modules may also be implemented in software for execution by varioustypes of processors. An identified module of executable code may, forinstance, comprise one or more physical or logical blocks of computerinstructions which may, for instance, be organized as an object,procedure, or function. Nevertheless, the executables of an identifiedmodule need not be physically located together, but may comprisedisparate instructions stored in different locations which, when joinedlogically together, comprise the module and achieve the stated purposefor the module.

Indeed, a module of executable code could be a single instruction, ormany instructions, and may even be distributed over several differentcode segments, among different programs, and across several memorydevices. Similarly, operational data may be identified and illustratedherein within modules, and may be embodied in any suitable form andorganized within any suitable type of data structure. The operationaldata may be collected as a single data set, or may be distributed overdifferent locations including over different storage devices, and mayexist, at least partially, merely as electronic signals on a system ornetwork.

Reference throughout this specification to “one embodiment,” “anembodiment,” or similar language means that a particular feature,structure, or characteristic described in connection with the embodimentis included in at least one embodiment of the present invention. Thus,appearances of the phrases “in one embodiment,” “in an embodiment,” andsimilar language throughout this specification may, but do notnecessarily, all refer to the same embodiment.

Furthermore, the described features, structures, or characteristics ofthe invention may be combined in any suitable manner in one or moreembodiments. In the following description, numerous specific details areprovided, such as examples of programming, software modules, userselections, network transactions, database queries, database structures,hardware modules, hardware circuits, hardware chips, etc., to provide athorough understanding of embodiments of the invention. One skilled inthe relevant art will recognize, however, that the invention can bepracticed without one or more of the specific details, or with othermethods, components, materials, and so forth. In other instances,well-known structures, materials, or operations are not shown ordescribed in detail to avoid obscuring aspects of the invention.

FIG. 1 depicts one embodiment of a typical prior art networkingenvironment 100 that demonstrates the issues regarding managingcurrently deployed enterprises. As depicted, the networking environment100 includes one or more servers 110, a network 120, and one or morenetworked computers 130. The components of the networking environment100 may reside at a single site or may be dispersed over multiple sites.

Some of the servers 110 may be directory servers or domain servers whichcan function as a registry for resources and users of the networkingenvironment 100. The network 120 may include routers, bridges, hubs,gateways, or the like which facilitate communications among thecomponents of the networking environment 100. Some of the networkedcomputers 130 may execute legacy applications and operating systems thatare unable to integrate with the servers 110 that are directory servers.

Some of the networked computers 130 may be used to run utilityapplications to manage the servers 110 that are directory servers andfeatures of the directory service that runs on the servers 110. Thesenetworked computers 130 that manage the directory service typically donot include functionality to manage foreign operating systems that mayrun on other networked computers 130.

FIG. 2 is a schematic block diagram illustrating one embodiment of aprior art policy management apparatus 200. The prior art policymanagement apparatus 200 includes a policy template 210, a policy editor220, a first computer 260 having a native operating system, and a secondcomputer 270 having the same native operating system. The first computer260 includes a policy manager 230 a, a policy-related file 240, and aconfiguration information database 250 a. The second computer 270includes a policy manager 230 b, and a configuration informationdatabase 250 b. This apparatus is configured to efficiently manage agroup of computers having like operating systems.

An administrative user may use a policy template 210 and a policy editor220 to control the operation of the policy manager 230 a. The policytemplate 210 and the policy editor 220 may be located on the firstcomputer 260 or may be on another computer. The policy manager 230 a mayuse a policy-related file 240 and settings (i.e. information) in aconfiguration information database 250 a to record the policy settingscreated by the administrative user.

As a means for efficiently managing a group of computers with likeoperating systems, a policy manager 230 b in a second computer 270 maybe configured to obtain policy settings by reading from thepolicy-related file 240 or the configuration information con database250 a on the first computer 260, as represented by the dashed lines 233and 236 in FIG. 2. The policy manager 230 b may then make settings tothe configuration information database 250 b on the second computer 270.

The policy may include configuration information that appliesspecifically to the second computer 270, or to a specific user or any ofa group of users of the second computer 270. Configuration informationmay be associated with network directory services containers andobjects. For example, by associating configuration information with anorganizational unit container, the behavior of an application can becontrolled for all users in a company department. Configurationinformation maybe assigned to containers and objects at various levelsin a directory services hierarchy, facilitating management of hardwareand software configuration information at various organizational,geographical, or individual levels. For example, applicationconfiguration information may be associated with an organizationcontainer, organizational unit container, and user object in a networkdirectory services hierarchy, resulting in application configurationoptions being assigned at corporate, departmental, and individual levelsin an organization.

FIG. 3 is a schematic block diagram illustrating one embodiment of apolicy management system 300 in accordance with the present invention.The depicted policy management system 300 includes a network 310, afirst computer 320, and a second computer 340. The first computer 320includes a policy template 322, a policy editor 324, a policy manager230, a policy-related file 326, and a configuration information database250. The depicted second computer 340 includes a translator manager 342,a translator 344, and a policy-related file 346. The policy managementsystem 300 facilitates management of a group of computers with multipleoperating systems by using the first computer 320 as a referencecomputer from which configuration information are replicated to othercomputers in a workgroup, or the. like. The policy management system 300depicted in FIG. 3 represents a peer-oriented embodiment of the presentinvention, where the first computer 320 and the second computer 340 areworkstations, and no server is required.

An administrative user may use a policy template 322 and policy editor324 to control the operation of the policy manager 230. The policymanager 230 may use a policy-related file 326 and settings orinformation in a configuration information database 250 to record thepolicy settings created by the administrative user. The translationmanager 342 in the second computer 340 may be configured to obtainpolicy settings by reading from the policy-related file 326 and theconfiguration information database 250 on the first computer 320, asrepresented by the dashed lines 333 and 336 in FIG. 3. The translationmanager 342 then passes the policy settings obtained from the firstcomputer 320 to the translator 344 to translate to configurationinformation that may be stored in a policy-related file 346 on thesecond computer 340. In some embodiments, the translator 344 modifiesconfiguration information stored in a plurality of files. Thepolicy-related file 346 may not be exclusively dedicated to storingpolicy information. For example, the policy-related file 346 may containnon-policy data or code. In some embodiments, the operating system onthe first computer 320 may provide an event notification system thatnotifies the translation manager 342 that changes have been made to thepolicy-related file 326 or the configuration information database 250.

FIG. 4 is schematic block diagram illustrating another embodiment of apolicy management system 400 in accordance with the present invention.The policy management system 400 includes a server 410, network 310, afirst computer 320, and a second computer 340. The server 410 includes apolicy-related file 413, and a configuration information database 416.The first computer 320 includes a policy template 322, a policy editor324, and a policy manager 230. The second computer 340 includes atranslation manager 342, a translator 344, and a policy-related file346. The policy management system 400 facilitates management of a groupof computers having multiple operating systems by replicatingconfiguration information from a server 410, such as a directory server.The policy management system 400 depicted in FIG. 4 represents aclient-server-oriented embodiment of the present invention, whereconfiguration information are stored on a server 410 and replicated toclient workstations represented by the second computer 340.

As with the embodiment depicted in FIG. 3, an administrative user mayuse a policy template 322 and policy editor 324 to control the operationof the policy manager 230. In this embodiment, however, the policymanager 230 may use a policy-related file 413 and settings in aconfiguration information database 416 to record the policy settingscreated by the administrative user on a server 410. The translationmanager 342 in the second computer 340 may be configured to obtainpolicy settings by reading from the policy-related file 413 and theconfiguration information database 416 on the server 410, as representedby the dashed lines 433 and 436 in FIG. 4. The translation manager 342then passes the policy settings obtained from the first computer 320 tothe translator 344 to translate to configuration information that may bestored in a policy-related file 346 on the second computer 340.

The following schematic flow chart diagrams that follow are generallyset forth as logical flow chart diagrams. As such, the depicted orderand labeled steps are indicative of one embodiment of the presentedmethod. Other steps, methods, and orderings may be conceived that areequivalent in function, logic, or effect to one or more steps, orportions thereof, of the illustrated method.

FIG. 5 is a schematic flow chart diagram illustrating one embodiment ofa provide translator method 500 in accordance with the presentinvention. The provide translator method 500 includes a provide policytemplate step 520, and a provide policy translator step 530. The providetranslator method 500 provides modules that facilitate translation ofpolicy settings from a native operating system to a foreign operatingsystem.

The provide policy template step 520 provides a policy template such asthe policy template 322 to be used in conjunction with the policy editor324, or the like. As detailed in FIG. 3 and elsewhere, the policytemplate 322 constrains policy editing, such that policies created bythe policy editor 324 conform to requirements of the first computer 320.For example, the policy template 322 may ensure that configurationinformation car delivered to the policy manager 230 conform to arequired syntax, or that numerical values fall within a meaningfulrange. The provide policy template step 520 may provide a plug-in moduleto an operating system utility program. In some embodiments, the providepolicy template step 520 provides a wizard program module that guides auser through the process of creating a policy.

The provide policy translator step 530 provides a translator 344 thattranslates configuration information from the first computer 320 havinga native operating system to the second computer 340 having a foreignoperating system. The provide policy translator step 530 may place thetranslator 344 in a file system directory known to the translatormanager 342. In some embodiments, the provide policy translator step 530may register the file system location of the translator 344 with thetranslator manager 342. Upon completion of the provide policy translatorstep 530, the provide translator method 500 ends 540.

FIG. 6 is a schematic flow chart diagram illustrating one embodiment ofa policy translation method 600 in accordance with the presentinvention. The policy translation method 600 includes a provide policystep 620, a receive policy step 630, a translate policy step 640, anupdate configuration step 650, an update on start-up test 655, a waitfor start-up step 660, an update on login test 665, a wait for loginstep 670, a refresh time test 675, and a terminate test 685. The policytranslation method 600 translates policies on a first computer 320having a native operating system to policies for a second computer 340having a foreign operating system.

The provide policy step 620 provides a policy on the first computer 320having a native operating system. The provide policy step 620 may beperformed by an administrative user using a policy template 322, policyeditor 324, and/or policy manager 230. The policy may be contained in apolicy-related file 326 and a configuration information database 250 onthe first computer 320. In some embodiments, the policy may be containedin a policy-related file 413 and a configuration information database416 on a server 410, such as a directory server.

The receive policy step 630 receives the policy on the second computer340 having a foreign operating system. The receive policy step 630 maybe performed by a translator manager 342 on the second computer 340. Thetranslator manager 342 may copy the policy from a policy-related file326 and a configuration information database 250 on the first computer320. In other embodiments, the translator manager 342 may copy thepolicy from a policy-related file 413 and a configuration informationdatabase 416 on a server 410, such as a directory server. The translatormanager 342 transmits the policy to a translator 344.

The translate policy step 640 translates configuration information fromthe first computer 320 having a native operating system to the secondcomputer 340 having a foreign operating system. The translate policystep 740 may be performed by a translator 344 on the second computer340. The translator 344 receives the policy from the translator manager342 and translates the policy to foreign operating system configurationinformation used by the second computer 340.

The update configuration step 650 applies the configuration informationtranslated by the translator 344. The update configuration step 650 maybe performed by a translator 344 on the second computer 340 having aforeign operating system. After translating the policy to foreignoperating system configuration information, the translator 344 appliesthe policy by saving the configuration information in a policy-relatedfile 346. In some embodiments, configuration information may be saved ina plurality of policy-related files 346.

The update on start-up test 655 determines whether the policy is to beapplied at workstation start-up. A policy may contain configurationinformation for all users of the second computer 340. Many operatingsystems apply configuration information at workstation start-up.Updating configuration information on the second computer 340 duringworkstation start-up makes the updated settings available forapplication during the workstation start-up process. If the policy is tobe updated at workstation start-up, the policy translation method 600continues with the wait for start-up step 660, otherwise the policytranslation method 600 continues with the update on login test 665.

The wait for start-up step 660 waits for the second computer 340 toreach a point in the workstation start-up process where computerresources are available for the second computer 340 to receive thepolicy from the first computer 320. The wait for start-up step 660includes setting a configuration setting that causes the policytranslation method 600 to continue with the receive policy step 630 atworkstation start-up. The wait for start-up step 660 facilitatesreceiving the current version of the policy so that configurationinformation may be applied to the second computer 340 at workstationstart-up, when many operating systems typically read configurationinformation. Updating a policy at workstation start-up is particularlyadvantageous to workstation-specific configuration information.

The update on login test 665 determines whether the policy is to beapplied at user login. A policy may contain configuration informationthat applies to a specific user or any of a group of users of the secondcomputer 340. In some embodiments, configuration information may beassociated with network directory services containers and objects. Forexample, by associating configuration information with an organizationalunit container, the behavior of an application can be controlled for allusers in a company department. Updating configuration information on thesecond computer 340 makes the current version of the settings availablefor application for the user logging in. If the policy is to be updatedat user login, the policy translation method 600 continues with the waitfor login method 670, otherwise the policy translation method 600continues with the refresh time test 675.

The wait for login step 670 waits for a user to log in to the secondcomputer 340 to receive the policy from the first computer 320. The waitfor login step 670 includes setting a configuration setting that causesthe policy translation method 700 to continue with the receive policystep 630 at user login. The wait for login step 670 facilitatesreceiving the current version of the policy so that configurationinformation may be applied to the second computer 340 at user login,when many operating systems typically read configuration information.Updating a policy at user login is particularly advantageous touser-specific configuration information.

The refresh time test 675 determines whether it is time to check forupdates to the policy on the first computer 320. In some embodiments,the refresh time test 675 polls the first computer 320 at periodicintervals for changes to the policy. The polling interval may beconfigurable by the user or may itself be a setting configurable by apolicy. In some embodiments, the refresh time test 675 may include ameans for the first computer 320 to notify the second computer 340 thata change has been made to the policy, and that the policy should berefreshed on the second computer 340. If the refresh time has arrived,the policy translation method 600 continues with the receive policy step630, otherwise it continues with the terminate test 685.

The terminate test 685 determines whether the refresh time test 675should be repeated, or if the policy translation method 600 shouldterminate. In some embodiments, the policy translation method 600 may beterminated to facilitate deallocation of memory or other computerresources when the second computer 340 is shut down, or to allow forsystem maintenance. If the policy translation method is not to beterminated, it continues with the refresh time test 675, other wise itends 690.

FIG. 7 is a text diagram illustrating one embodiment of policytranslation example data in accordance with the present invention. Thepolicy translation example data 700 includes policy template data 710,policy manager input data 720, native policy-related file data 730, andtranslated policy-related file data 740. The policy translation exampledata may be generated in accordance with the policy translation method600 and the policy management system 300.

The policy template data 710 is one example of the policy template 322.The policy template 322 may reside on the first computer 320 having anative operating system or on a third computer, such as anadministrative workstation. The policy template data 710 may compriseplain ASCII text used to constrain data input accepted by the policyeditor 324 by identifying names of data objects that the policy editor324 will allow the user to edit. Policy template data 710 may alsocontain the text of prompts or other fields that control the userinterface presented by the policy editor 324. Using the policy template322, the policy editor 324 may accept input from an administrative userand generate input data for the policy manager 230.

Policy manager input data 720 illustrates the format of data that may begenerated by the policy editor 324. In various embodiments, inaccordance with the provide policy step 620, the policy manager 230 mayaccept the policy manager input data 720 from a file created by thepolicy editor 324, from a file created by an administrative user, orcommunicated directly from the policy editor 324 to the policy manager230 via interprocess communication. The policy manager 230 may alter theformat or contents of the policy manager input data 720. In someembodiments, the policy manager creates a policy-related file 326 andenters the location of the policy-related file 326 in the configurationsettings database 250.

The native policy-related file data 730 is a textual representation ofbinary data in one embodiment of the policy-related file 326. The nativepolicy-related file data 730 is generated by the policy manager 230, andin preparation for the receive policy step 630, is stored in a formatand location typically used with the native operating system in use onthe first computer 320. In the depicted embodiment, the nativepolicy-related file data 730 comprises mixed binary and UNICODE textdelimited by square brackets.

The translated policy-related file data 740 is one example of thepolicy-related file 346. In accordance with the translate policy step640, the translator 344 translates the policy data received from thetranslator manager 342 to data usable by the foreign operating systemused by the second computer 340. The depicted translated policy-relatedfile data 740 is one example of a configuration file that a translator344 has converted from mixed binary and UNICODE format to plain ASCIItext format, and filtered to include only data usable by the foreignoperating system in use on the second computer 340. In the depictedexample, the translated policy-related file data 740 comprises a list ofuser names that will be allowed to log in to the second computer 340.

The present invention may be embodied in other specific forms withoutdeparting from its spirit or essential characteristics. The describedembodiments are to be considered in all respects only as illustrativeand not restrictive. The scope of the invention is, therefore, indicatedby the appended claims rather than by the foregoing description. Allchanges which come within the meaning and range of equivalency of theclaims are to be embraced within their scope.

1. A signal bearing medium tangibly embodying a program ofmachine-readable instructions executable by a digital processingapparatus to perform operations to manage policies on a computer havinga foreign operating system, the operations comprising: receiving apolicy on a second computer having a foreign operating system, thepolicy constructed on a first computer having a native operating systemaccording to a policy standard developed for, and utilized by, thenative operating system, and wherein the foreign operating system doesnot directly utilize the policy standard developed for, and utilized by,the native operating system; and executing a translator on the secondcomputer, the translator configured to execute under the foreignoperating system and translate the policy from the policy standarddeveloped for, and utilized by, the native operating system toconfiguration information usable by the foreign operating system.